OWASP LLM03:2025 Supply Chain risk maps to existing supplier risk duties: NIST SP 800-161 Rev. 1 on cybersecurity supply chain risk, the NIST AI Risk Management Framework and its generative AI profile, and EU AI Act Articles 17 and 25. Treat third party models, adapters and datasets like any other supplier, and keep records to prove it.
Which sources does this mapping use?
I fetched four documents and mapped only what they say: the OWASP LLM03 page, the NIST SP 800-161 Rev. 1 page, the NIST AI RMF page, and Articles 17 and 25 of the EU AI Act. I did not fetch the text of ISO 27001, SOC 2 or NIST CSF controls, so this post does not number those controls. If your audit uses them, map the same activities onto the supplier clauses your auditor cites.
This is an explanation of frameworks. Safeguard does not certify you against any of them.
How does LLM03 line up with NIST SP 800-161?
NIST describes the publication as addressing risks from products and services that may contain malicious functionality, be counterfeit, or be vulnerable through weak development practices, arising from limited visibility into how acquired technology is built. It guides organisations to identify, assess and mitigate those risks at all levels, including C-SCRM strategy, policies and risk assessments of products and services.
LLM03 is that same problem with new artefacts. A pre-trained model is a product you cannot inspect easily, and OWASP says as much about weak provenance. The mapping:
- Vet suppliers, including terms and privacy policies (OWASP) matches supplier risk assessment.
- Signed SBOM and AI or ML BOM matches the visibility NIST says organisations lack.
- Patch and monitor components matches vulnerability handling for acquired products.
How does it line up with the NIST AI RMF?
NIST describes the AI Risk Management Framework as voluntary, released on 26 January 2023, and notes that the Generative AI Profile (NIST AI 600-1) followed on 26 July 2024 to help identify risks specific to generative AI. The page I fetched does not discuss third party components, so use the profile text itself when you build a control list. Record model provenance, evaluation results and supplier terms in your AI risk register so the framework's governance activities have evidence.
How does it line up with the EU AI Act?
Article 25 requires providers of high-risk systems to agree in writing with third parties that supply tools, services, components, models or processes used in the system, setting out the information, access and help the provider needs to meet its obligations. That excludes publicly available components under a free and open-source licence, other than general-purpose AI models. Article 17 lists a quality management system that includes data management, risk management, resource management including measures to secure supply, and record keeping. The application dates for high-risk obligations on the Commission's site are 2 December 2027 for Annex III and 2 August 2028 for Annex I.
What evidence should you keep?
| Activity | Evidence |
|---|---|
| Supplier vetting | Due diligence notes, terms copy, date |
| Component inventory | SBOM and AI BOM per release |
| Provenance check | Hashes and signature results for each model and adapter |
| Evaluation | Red team and regression results per version |
| Contract | Written agreement with each model or component supplier |
| Monitoring | Alerts and tickets for unapproved artifacts |
What to do
- Build an inventory of every model, adapter, dataset and AI related package, with owner and purpose.
- Classify each supplier by criticality and data exposure.
- Sign or contract with suppliers where Article 25 style written agreements apply.
- Generate an AI BOM for each release.
- Store verification records with dates.
- Review quarterly, and after any supplier terms change. Safeguard's compliance automation can hold the evidence beside the other frameworks you track.
Quick check
Does the EU AI Act require supplier agreements for AI components?
Article 25 requires providers of high-risk systems to agree in writing with third party suppliers of tools, services, components and models, with an exception for most free and open-source components.
Is there a NIST document for supply chain risk?
Yes. NIST SP 800-161 Rev. 1 covers cybersecurity supply chain risk management practices for systems and organisations.
Sources
- OWASP GenAI, LLM03:2025 Supply Chain
- NIST SP 800-161 Rev. 1
- NIST AI Risk Management Framework
- EU AI Act, Article 25
- EU AI Act, Article 17
- European Commission, AI regulatory framework and timeline
Last reviewed: 18 October 2026.
